How to exclude string keyword in same field while using transaction command?

[karthi2809]

Thanks in Advance.

In my scenario i want to club the the result using correlationID .so i used transaction command .Below query have multiple conditions are checking from same field called message.So i want to exclude some of the search string in this.So after the transaction i tried to exclude the search string but i am not getting the result.

index="mulesoft"   applicationName="concur" environment=DEV  
("Concur Ondemand Started*") OR (message="Expense Extract Process started for jobName :*")  OR ("Before Calling flow archive-Concur*") OR (message="Concur AP/GL File/s Process Status*")  OR (message="Records Count Validation Passed*") OR  (message="API: START: /v1/expense/extract/ondemand*" OR message="API: START: /v1/fin*") OR (message="Post - Expense Extract processing to Oracle*") | transaction  correlationId| search NOT ("*Failed Processing Concur*")| rename content.SourceFileName as SourceFileName content.JobName as JobName  content.loggerPayload.archiveFileName AS ArchivedFileName content.payload{} as Response content.Region as Region content.ConcurRunId as ConcurRunId content.HeaderCount as HeaderCount content.SourceFileDTLCount
 as SourceFileDTLCount content.APRecordsCountStaged
 as APRecordsCountStaged content.GLRecordsCountStaged
 as GLRecordsCountStaged
| eval "FileName/JobName"= coalesce(SourceFileName,JobName)| eval JobType=case(like('message',"%Concur Ondemand Started%"),"OnDemand",like('message',"Expense Extract Process started%"),"Scheduled", true() , "Unknown")| eval Status=case(like('message' ,"%Concur AP/GL File/s Process Status%"),"SUCCESS", like('message',"%EXCEPTION%"),"ERROR") 
 |table correlationId "FileName/JobName" Status ArchivedFileName JobType Response Region ConcurRunId HeaderCount SourceFileDTLCount APRecordsCountStaged GLRecordsCountStaged

[scelikok]

Hi @karthi2809,

Since there is no _raw data after transaction command you cannot make free text searches. You should search using specific field like 

| search NOT message="*Failed Processing Concur*"

[PickleRick]

Actually, there is _raw after transaction. It's comprised of merged values of _raw field of events making up the transaction.

But the question is whether there are any events matching this condition.

First think I'd check would be to search without the "NOT" condition and see if it matches any events at all.